Features

What Verfy does, and where it stops

Each capability below lists its limits next to it. Verfy only claims what it can show.

Verfy Lock

verfy.lock pins the SHA-256 of each tool's canonical name, description and input schema.

Drift: A tool whose definition changed is hidden from the agent and its calls are denied (VFY-TOOL-004) until someone approves the change.
New tools: A tool added to an already locked server needs approval by default (VFY-TOOL-006).
Review: verfy lock diff shows a readable diff with invisible characters spelled out; verfy lock approve records who accepted it.
CI: verfy lock check starts the servers in .mcp.json and compares them with the committed verfy.lock. The GitHub Action runs it on every pull request and fails the check when a tool changed.
Team: Devices propose changes; an admin approves once in the dashboard and every device picks it up with verfy team pull.

Limits. A lock proves a definition did not change since it was approved. It says nothing about whether the approved definition was safe.

Verfy Receipts

Every decision becomes a verfy.receipt/1 record, signed with Ed25519 and chained with SHA-256.

Contents: Sequence number, previous hash, time, agent, session, server, tool, action kind, SHA-256 of the arguments, verdict, rule IDs, policy hash, tool digest and outcome.
Privacy: Arguments and results are stored as hashes by default. Storing redacted arguments is an explicit local setting.
Verification: verfy verify checks every signature and link offline. The Team server checks them again on upload and on demand.
Standard format: verfy scitt export writes each receipt as an IETF SCITT signed statement (COSE_Sign1 with CWT claims), so a SCITT transparency service or any COSE library can check it. Verfy does not run a transparency service.

Limits. A receipt shows what passed through Verfy and that the record was not changed afterwards. It does not show what a tool did internally, or actions that bypassed the hook or gateway.

Verfy Guard

A deterministic pre-check for every tool call, through a Claude Code PreToolUse hook or the MCP gateway.

Shell: Recursive deletes of home, root or the project, disk formatting, fork bombs, force-push, publishing and deploy commands, sudo, curl-to-shell, reading secrets in a command that also uses the network.
Files: Writes to protected paths (~/.ssh, /etc, git hooks, shell profiles, the Verfy folder), sensitive files such as .env and private keys, writes outside the project.
Network: Cloud metadata endpoints, tunnels and request bins, credentials in URLs, an allow list for everything else.
Data and money: Destructive SQL without a WHERE clause, payment limits, daily budgets, unknown recipients, secrets in arguments.
Your rules: Tool deny/ask lists, custom regex rules per tool or argument, disabled rules, all in one JSON policy.

Limits. Pattern matching is not a sandbox. Commands Verfy cannot classify are not assumed safe; pair Verfy with OS-level isolation for untrusted code.

Verfy Scan

Finds MCP servers in Claude Code (.mcp.json, ~/.claude.json), Cursor and Claude Desktop configs, and checks tool definitions.

Config checks: Unpinned npx/uvx packages, curl | sh launchers, plain-http remote servers, remote servers without auth, secrets written into configs, privileged containers.
Tool checks: Hidden instructions and tool poisoning, references to other tools (shadowing), invisible Unicode, long encoded blobs, secrets, misleading read-only hints.
Results: Each finding has a rule ID, severity, where it was found and what to do. --json output and exit codes for CI.

Limits. The config check is static and never starts a server. Fetching tool lists (--live) starts each stdio server you configured, only when you ask. A clean scan is not a guarantee that a tool is safe.

Verfy Team

The web platform

Runs on your own Vercel and Supabase projects. Every table is protected by row-level security and every change is audited.

Policies with history

Edit the team policy as JSON, validate it, and see every published version with who published it.

Policy simulator

Before publishing, Verfy replays a corpus of sample agent actions and refuses a policy that would block most everyday work.

Lock approvals

Pending tool changes with the diff from the approved version; approve or reject, recorded in the audit log.

Devices

Enroll laptops and CI runners with one-time codes, see when they last synced, revoke one instantly.

Receipts

Search and filter by verdict, tool, device and date; open any receipt to see its signature check and chain position.

Evidence exports

JSONL plus a manifest with SHA-256 hashes and public keys, downloadable through 60-second links.

Roles

Owner, admin, member and auditor, enforced by Postgres row-level security, not just hidden buttons.

Audit log

A hash-chained, append-only record of every policy, member, device, lock and export change.

Not built yet: verified-tool certification, insurance or guarantees, payment clearing, and a public tool registry. They are on the roadmap as later phases and are not part of this product today.

Create your team Read the docs